Anomaly-driven software switch to capture event responses and automate recovery

ABSTRACT

Anomaly-driven software for capturing and automating responses to computer anomalies is disclosed. Computer anomalies are processed by identifying the occurrence of an anomaly and correcting the computer anomaly by initiating a stored corrective action based on a user&#39;s input for resolving the anomaly.

BACKGROUND OF THE INVENTION

1. Field of the Invention

The present invention relates in general to computer software, and moreparticularly to anomaly-driven software for capturing and automatingresponses to computer anomalies.

2. Description of the Related Art

Computer systems typically include a processor coupled to a hierarchicalstorage system. The system's hardware can dynamically allocate parts ofmemory within the storage hierarchy for addresses deemed most likely tobe accessed soon. The type of storage employed in each stage of thehierarchy relative to the processor is normally determined by balancingrequirements for speed, capacity, and costs.

Computer processes continually refer to this storage over theirexecuting life times, both reading from and writing to the stagedstorage system. These references include self-referencing as well asreferences to every type of other process, overlay or data. It iswell-known in the art that data storage devices using high-speed randomaccess memories (RAM) can be referenced orders of magnitude faster thanhigh volume direct-access storage devices (DASD's) using rotatingmagnetic media. Such electronic RAM storage relies upon high-speedtransfer of electrical charges over small distances, while DASD'stypically operate mechanically by rotating a data storage position on amagnetic disk with respect to read-write heads. The relative cost of abit of storage for DASD and RAM makes it necessary to use DASD for bulkstorage and electronic RAM for processor internal memory and caching.

A wide variety of computer processing errors regularly occur in computersystems. Some may be relatively inert and the computer system maycontinue to operate in its normal capacity. Other computer errors canresult in a system failure and may require restarting the computersystem. In order to correct processing errors that fall between the twoextremes, corrective actions need to be taken.

Correcting computer processing errors can be complicated and may bedifficult to remember if the same error occurs in the future. Somecomputer applications include a recording function, which allow forrecording of actions taken to correct the computer error. However, suchapplications require a user to manually initiate recording and replayingthe actions taken.

In addition to computer processing errors, computer systems can presentcomputer operators with other unwanted events or anomalies. One suchevent can take the form of a pop-up message, for example. Computerapplications similar to the application described above can be used torecord steps taken to remove the message. However, and similar to above,the computer operator may be required to manually initiate recording andreplaying actions taken to remove the message.

Efficiently and effectively correcting computer processing errors andhandling other general but unwanted events are becoming more importantas computers are increasingly depended upon. When a computer operator isrequired to manually initiate recording processes for correctingcomputer processing errors or other unwanted events, inefficiencies canresult. Furthermore, the steps taken by a computer operator may or maynot be an effective method to overcome the computer anomaly.

It can be seen that there is a need for a method and apparatus forinitiating and evaluating recorded computer processes for efficient andeffective correction of future occurrences of the same or similarcomputer anomaly.

SUMMARY OF THE INVENTION

To overcome the limitations in the prior art described above, and toovercome other limitations that will become apparent upon reading andunderstanding the present specification, the present invention disclosesa method, apparatus and program storage device for capturing andautomating responses to computer anomalies.

Embodiments of the present invention solve the above-mentioned problemsby processing computer anomalies by identifying the occurrence of ananomaly and correcting the computer anomaly by initiating a storedcorrective action based on a user's input for resolving the anomaly.

A program storage device in accordance with an embodiment of the presentinvention includes program instructions executable by a processingdevice to perform operations for processing computer anomaly resolutionsincluding detecting at least one computer anomaly and recording useraction taken to resolve the anomaly.

In another embodiment of the present invention, another program storagedevice is provided. These program instructions are executable by aprocessing device to perform operations for processing computer anomalyresolutions including detecting at least one computer anomaly andinitiating a recorded action for resolving the at least one computeranomaly.

In another embodiment of the present invention, a system for processingcomputer anomaly resolutions is provided. The system includes a computerprocessor configured to detect at least one computer anomaly and amemory coupled to the processor configured to record user action takento resolve the anomaly.

In another embodiment of the present invention, another system forprocessing computer anomaly resolutions is provided. This systemincludes a processor configured to detect at least one computer anomalyand a memory, coupled to the processor, configured to store a set ofrecorded actions for resolving the at least one computer anomaly,wherein the processor is configured to initiate the set of recordedaction stored in the memory upon detecting a computer anomaly.

These and various other advantages and features of novelty whichcharacterize the invention are pointed out with particularity in theclaims annexed hereto and form a part hereof. However, for a betterunderstanding of the invention, its advantages, and the objects obtainedby its use, reference should be made to the drawings which form afurther part hereof, and to accompanying descriptive matter, in whichthere are illustrated and described specific examples of an apparatus inaccordance with the invention.

BRIEF DESCRIPTION OF THE DRAWINGS

Referring now to the drawings in which like reference numbers representcorresponding parts throughout:

FIGS. 1 a and 1 b are flowcharts of methods of recording and resolvingcomputer anomalies in accordance with the present invention;

FIG. 2 is a block diagram of a system that incorporates methods forresolving computer anomalies in accordance with embodiments of theinvention;

FIG. 3 is another block diagram of a system that incorporates methodsfor resolving computer anomalies in accordance with embodiments of theinvention;

FIGS. 4 a and 4 b are flowcharts of methods of recording and resolvingcomputer anomalies in accordance with the present invention; and

FIG. 5 is a flowchart of another method for responding to computeranomalies in accordance with the present invention.

DETAILED DESCRIPTION OF THE INVENTION

In the following description of the embodiments, reference is made tothe accompanying drawings that form a part hereof, and in which is shownby way of illustration the specific embodiments in which the inventionmay be practiced. It is to be understood that other embodiments may beutilized because structural changes may be made without departing fromthe scope of the present invention.

A method, apparatus and program storage device for capturing andautomating responses to computer anomalies is provided. Computeranomalies are processed by identifying the occurrence of an anomaly andcorrecting the computer anomaly by initiating a stored corrective actionbased on a user's input for resolving the anomaly.

FIG. 1 a illustrates a method 102 for processing computer anomalyresolutions includes detecting 110 at least one computer anomaly andrecording 120 the user input taken to resolve the anomaly. An anomalymay include the presence of any unusual and potentially hazardous statewithin the activities of a computer user, system, or network. “Unusual”is defined with respect to some model of “normal” behavior that may beeither hard-coded or learned from observation. An anomaly may alsoinclude operational variance from normal operation of a computer,system, or network. Some examples of an operational variance include,but are not limited to, computer processing errors, a failed correctionsequence, human error, a state that inhibits user work such as acomputer freezing or hanging and a user defined state. Furthermore,users or developers can define anomalies. For example, a user may chooseto define an Internet pop-up window as an anomaly, with the recordedresponse being the automatic closure of any pop-up. Or a user may notlike a virus scanning software program starting at random on its own andso establishes its start as an anomaly, with the necessary steps forshutting it down being the recorded response.

Saved responses can be stored in detail or can be stored as generalparameters. A detailed recorded response can resolve future occurrencesof the same or relatively similar computer anomalies. Saving user inputin general terms can allow for the resolution of a wider variety ofcomputer anomalies. Mapping saved actions to other similar anomalies byinserting/applying user-generated action-specific parameters to ageneralized set of responses can effectively remedy computer anomalies.

FIG. 1 b illustrates a method 102 for processing computer anomalies inaccordance with further embodiments of the invention. At least onecomputer anomaly is detected 112 and a previously recorded action forresolving computer anomaly is initiated 122. Such an action can includeuser actions described above in FIG. 1 a.

FIG. 2 illustrates a system 200 according to the present invention,wherein the processes illustrated in FIGS. 1 a, 1 b and 3-5 may betangibly embodied in a computer-readable medium or carrier, e.g. one ormore of the fixed and/or removable data storage devices 210 or otherdata storage or data communications devices. A computer program 220expressing the processes embodied on the removable data storage devices210 may be loaded into the memory 230 or into the system 200, e.g., in aprocessor 240, to configure the system 200 of FIG. 2 for execution. Thecomputer program 220 comprise instructions which, when read and executedby the system 200 of FIG. 2, causes the system 200 to perform the stepsnecessary to execute the steps or elements of the present invention.

FIG. 3 is a more detailed embodiment of a system 300 that implementsanomaly-driven software in accordance with embodiments of the presentinvention. Processor 310 in system 300 operates by receivinginstructions and data from various sources including memory 320 and fromusers through user interactions with keyboard 330 and mouse 340. Memory320 can be embodied in a variety of forms including disk drivers, tape,CD-ROM and removable storage. Processor 310 detects computer anomaliesfound in system 300. Then, in an automatic anomaly response recordingmode, processor 310 informs the user that recording the response isinitiated and instructs memory 320 to capture computer user responsestaken to resolve the computer anomalies. Once computer user response hasresolved the computer anomaly the user can indicate recording iscomplete by, for example, entering a keystroke on keyboard 330. In amanual recording mode processor 310 can indicate to the user thatcomputer anomalies have been detected and then give the user the optionto record the response. After the user responds affirmatively by, forexample, clicking on an “OK” button found on screen 350 using mouse 340,processor 310 instructs memory 320 to capture responses performed by theuser to resolve the anomalies. Captured responses to computer anomaliescan be stored and replayed in future occurrences of the same or similarcomputer anomalies. When the same or similar computer anomalies aredetected by processor 320, the recorded responses to the anomalies areretrieved from memory 320 and replayed. In a replay situation processor310 can automatically run the recorded response to the detected computeranomalies and indicate to the user that the computer anomalies have beenresolved by, for example, sending a message to screen 350 to indicate tothe user that the anomaly has been resolved. Alternatively, afterprocessor 310 detects one or more computer anomalies the processor cansend the user a message indicating the anomalies have been detected andgive the user the option to manually run the recorded response. Infurther embodiments of the present invention, processor 310 can providea computer user with instructions on how to more efficiently overcomefuture occurrences of similar anomalies, or can provide informationrelated to the recorded set of actions to a user assistance directory.

FIG. 4 a illustrates method 400 for processing computer anomaliesillustrated in FIG. 1 a. Computer anomalies, in a variety of forms, aredetected 410 in accordance with the present invention. For example,computer processing errors 411, failed correction sequences 412 andhuman error 413 can be considered computer anomalies and be detected inembodiments of the invention. Inefficiencies 414 not necessarilyconnected to computer errors or failures can also be identified as ananomaly. In addition, a computer anomaly can be user defined 415. Thisallows the user to provide identification of certain annoying orinefficient events. Upon detecting 410 one or more computer anomaliesuser action taken to overcome the one or more anomalies is recorded 420.Recording user input to overcome computer anomalies can includerecording a series of operations performed in a network 421. Multipleusers 422 too can provide input in order to overcome computer anomalies.Alternatively, user input from a variety of sources can be processed 423and captured as user action for the resolution of computer anomalies.

FIG. 4 b shows a method 450 for processing computer anomaly resolutionsaccording to another embodiment of the present invention. At least onecomputer anomaly, which can take a variety of forms, is detected 460.Computer processing errors 461, failed correction sequences 462, humanerror 463, computer inefficiencies 464 and user defined anomalies 465can all be considered computer anomalies in accordance with theinvention. After detecting one or more computer anomalies, a previouslyrecorded action for resolving the detected 460 computer anomaly isinitiated 470. Previously recorded actions used to overcome one or morecomputer anomalies can include a set of actions taken by a user 471.User input 471 includes network input, multiple user input and processeduser input and can be altered by a user or by a computer program, forexample. Alternatively, a previously recorded code correction sequence472 can be used to resolve the detected computer anomaly and/or can beused to permanently correct computer code.

The methods 400, 450 described in FIGS. 4 a and 4 b can be set to runautomatically or manually. Methods operating automatically in accordancewith the invention can for example, allow a user to define variousevents as anomalies so that the detected events trigger on the recordingand/or initiating function. In an automatic recording function, adetected anomaly automatically triggers recordation of steps taken toresolve the user-defined anomaly. For automatic replay functions,initiating recorded actions automatically can allow for a user tocontinue working in a normal, uninterrupted manner while the computerprogram automatically resolves the detected anomaly.

FIG. 5 illustrates method 500 in accordance with embodiments of theinvention. After a computer anomaly is detected 510 and user action isrecorded 520, the recorded set of user input is evaluated 530.Evaluating the steps taken to resolve the anomaly can include evaluationby users, system administrators, support groups and computer programs.In the present embodiment, evaluating the set of user actions caninclude determining whether the user input was correct 535 for resolvingthe computer anomaly. When the input was not correct the set of recordedinput can be discarded 550. When the input is correct, an additionalevaluation step of determining whether the steps taken to resolve theanomaly were efficient 540 is determined. When efficient, the useraction is stored 560 for use in resolving future occurrences of the sameor similar computer anomaly. When correct but inefficient, the useraction can be further evaluated to determine if altering the input wouldresult in an efficient, standard corrective response for futureoccurrences of the anomaly. A determination is made whether altering theuser input would result in an effective method to overcome futureoccurrences of the detected anomaly 545. If yes, the user action isrevised 570 and stored in the revised form. When the user input wouldnot be effective, even if modified, the set of recorded input may bediscarded 550 or categorized as a set of actions that do not effectivelyresolve the detected computer anomaly.

In further embodiments, results generated from the evaluation can besent to a user for informational or training purposes. This allows theuser to learn how to most efficiently resolve similar computer anomaliesin situations where the user chooses to manually resolve similarcomputer anomalies, for example.

While operating manually or automatically, embodiments of the inventioncan be programmed such that when an identical anomaly occurs thesequence is replayed to resolve the anomaly. In further embodiments ofthe invention, a more generalized sequence is saved and used inresolving future instances of similar anomalies.

In situations where another anomaly occurs while a corrective sequenceis running the present invention can initiate another recording and/orinitiating function. Thus, the present invention allows for acontinually evolving sequence for review and repair. Further advantagesof this invention lie in its immediacy, in its capture of a computeruser's problem-solving activities, and in the potential option to replayactions for an identical situation encountered in the future.

In summary, an embodiment of the present invention provides a method forresolving computer processing anomalies by implementing user input andcomputer generated input. When anomalies occur in computer processes, arecording function that captures user command and computer responsesthat follow. The user takes several steps that involve accessing aparticular configuration and deleting or destroying it. In thisembodiment the actions succeed in correcting the error, and the optionexists to replay the recorded sequence if the identical problem appearsagain.

The anomaly parameters that drive the switch can be set at granular ormore general levels. If set to be so granular as to be implemented onlyfor a situation with the identical parameters, any similar anomalyhaving the slightest deviation would result in a new recording. Userswould interact with a process only when a new set of parametersinitiated an anomaly. In some cases exact parameters may not berelevant, and a more general application of the recording can beapplied. As long as the machine-generated response mirrors that in thecaptured sequence, no error or alarm is issued. The process runs tocompletion, freeing the user from the problem-solving tasks andeliminating calls to customer support. Thus, at least three problemsrelated to computer processing may be solved. First, when a computerprocessing anomaly occurs and the user takes the proper correctiveactions, the user must remember those actions and then repeat themwhenever the error again occurs.

An embodiment of the present invention allows the capture of thoseactions, which can then be run again automatically, or used to program apermanent fix. This frees the user from identifying the same error inthe future and taking the same set of corrective actions. Furthermore,developers are provided with a way to automate error correction in thecode, and the invention improves a product because it “learns” how tocorrect errors without user input. Next, when computer processinganomalies occur, the user often takes various actions that can help orhinder a resolution.

An embodiment of the present invention allows for a capture or recordingof those actions, which can then be evaluated. If the user's actionshindered a resolution, the record provides concrete details that help intraining the user, in updating the related user assistancedocumentation, and in providing other important information related tothe error. Lastly, in the general course of working with a computer,certain events occur that inhibit a user's work. This invention allowsfor the establishment of a standard response for certain standard,annoying events.

The foregoing description of the exemplary embodiments of the inventionhas been presented for the purposes of illustration and description. Itis not intended to be exhaustive or to limit the invention to theprecise form disclosed. Many modifications and variations are possiblein light of the above teaching. It is intended that the scope of theinvention be limited not with this detailed description, but rather bythe claims appended hereto.

1. A program storage device, comprising: program instructions executableby a processing device to perform operations for processing operationsfor processing computer anomaly resolutions, comprising: receiving auser computer anomaly recording mode selection input; selecting one ofan automatic computer anomaly recording mode and a manual computeranomaly recording mode in response to said user mode selection input;detecting at least one computer anomaly; in said automatic computeranomaly recording mode, automatically recording action taken by a userduring resolution of the anomaly; in said manual computer anomalyrecording mode: receiving a user computer anomaly recording initiationinput; and in response to said user recording initiation input,recording action taken by a user during resolution of the anomaly;evaluating the set of recorded user input taken to overcome the at leastone computer anomaly; and maintaining the recorded set of user inputbased on the evaluation for use in overcoming future occurrences of theat least one computer anomaly.
 2. The program storage device of claim 1,wherein the action taken by a user comprises input from multiple users.3. The program storage device of claim 1, wherein the action taken by auser comprises processed user input.
 4. The program storage device ofclaim 1 further comprising storing a revised set of user input based onthe evaluation for use in overcoming future occurrences of the at leastone computer anomaly.
 5. The program storage device of claim 1 furthercomprising discarding the set of recorded user input based on theevaluation.
 6. The program storage device of claim 1, wherein evaluatingthe set of recorded user input comprises determining whether the atleast the computer anomaly has been resolved by the recorded set ofactions.
 7. The program storage device of claim 1, wherein evaluatingthe set of recorded user input comprises determining whether the atleast one computer anomaly has been resolved efficiently.
 8. The programstorage device of claim 1 further comprising sending a user the resultsof the evaluation.
 9. The program storage device of claim 8, wherein theresults of the evaluation comprises instructions on overcoming futureoccurrences of the at least one computer anomaly.
 10. The programstorage device of claim 1, wherein the operations further comprise:detecting a second computer anomaly; and in an automatic replay mode:comparing said second computer anomaly to said at least one computeranomaly; and automatically replaying said recorded user input to resolvesaid second computer anomaly if said second computer anomaly issufficiently similar to said at least one computer anomaly.
 11. Theprogram storage device of claim 10, wherein the operations furthercomprise: in a manual replay mode: receiving a user replay initiationinput; and replaying said recorded user input to resolve said secondcomputer anomaly.
 12. The program storage device of claim 11, whereinthe operations further comprise: receiving a user replay mode selectioninput; and selecting one of said automatic replay mode and said replaymode in response to said user mode selection input.
 13. A system forprocessing computer anomaly resolutions, comprising: a computerprocessor configured to receive a user computer anomaly recording modeselection input, to select one of an automatic computer anomalyrecording mode and a manual computer anomaly recording mode in responseto said user mode selection input; and to detect at least one computeranomaly; a memory coupled to the processor wherein said processor isconfigured to: in said automatic computer anomaly recording mode,automatically record in said memory action taken by a user duringresolution of the anomaly; and in said manual computer anomaly recordingmode: receive a user computer anomaly recording initiation input; and inresponse to said user recording initiation input, record in said memoryaction taken by a user during resolution of the anomaly; wherein theprocessor is further configured to evaluate the set of recorded userinput taken to overcome the at least one computer anomaly, to send auser the results of the evaluation, and to provide instructions forresolving future occurrences of the at least one computer anomaly; and adisplay device configured to receive the sent results of the evaluation.14. The system of claim 13, wherein the memory is configured to recordinput from a computer network.
 15. The system of claim 13, wherein thememory is configured to record input from multiple users.
 16. The systemof claim 13, wherein the memory is configured to record input comprisingprocessed user input.
 17. The system of claim 13 further comprising asignal configured to indicate when the memory has completed recordingthe action taken by a user.
 18. The system of claim 17, wherein thesignal configured to indicate recording is complete comprises a keyboardstroke.
 19. The system of claim 13, wherein the processor is furtherconfigured to: detect a second computer anomaly; and in an automaticreplay mode: compare said second computer anomaly to said at least onecomputer anomaly; and automatically replay said recorded user input toresolve said second computer anomaly if said second computer anomaly issufficiently similar to said at least one computer anomaly.
 20. Thesystem of claim 19, wherein the processor is further configured to: in amanual replay mode: receive a user replay initiation input; and replaysaid recorded user input to resolve said second computer anomaly. 21.The system of claim 20, wherein the processor is further configured to:receive a user replay mode selection input; and select one of saidautomatic replay mode and said replay mode in response to said user modeselection input.